Scanning Lock-up

[Walker]

Hi Guys,

I have a P4 3.06. 1gig. Win XP-P.  SP1 and all updates.

Am trying out the HE before purchase (thanks for the opportunity). Have so far found one problem that perhaps you could advise me on.

Running a full scan in 'standard' mode seems ok, but if I switch to 'thorough' mode scanning hangs part of the way through the scan.

It hangs showing the Windows directory as being scanned, so I tried a 'thorough' scan just on that directory and it completes ok.

I have to do a ctrl-alt-del to shut the scan proccess down. Taskmanager say's that the scan is still running, but once I've selected 'End task' it reports it as 'Not responding'.

Any suggestions/ideas please?

[Vlk]

Interesting....

1. How much time did you give it before concluding that it's hung? (scan of some (big) files may take quite a long time)
2. Was the CPU usage high or low while the program was "hung"?
3. Do you have any huge files on your disks (let's say, > .5GB)?
4. Was archive scanning On or Off? Does it make any difference if you toggle it?

5. Try turning on generation of the report file (in the program settings), even for OK files. The file may then give as an indication of where it really stopped..

Thanks.
Vlk

[Walker]

Hi Vlk,

Thanks for the reply.

1. I’ve tried this several times, leaving it in what looks like the ‘hung’ state for anything between 5 – 20 mins.

2. CPU usage is low (practically zero) in this hung state. Once I try shutting it down from task manager CPU usage goes very high and stays high, but visually (Avast S. I.) remained locked on the file count and \Windows directory.

3. There’s gotta be a few large files knocking about on the disc. Can’t think where/what they are though.

4. Tried with Archive both on and off, same results either way. The only change is that a ‘standard’ scan seems to be ok, but this happens on the ‘thorough’ scan.

5. Turned the report on. Is this the actual file… “C:\Program Files\Alwil Software\Avast4\Data\report\Simple User Interface” ?. If so, here are the last few lines….

C:\WINDOWS\xpsp1hfm.log

• is OK

C:\WINDOWS\Zapotec.bmp

• is OK

C:\WINDOWS\_default.pif

• is OK

Disk D: Boot Record

• is OK

D:\71b78a12c0e8dd9903aa\sp2\update\update.exe

• is OK

D:\849111747cfcd62f212\sp2\update\update.exe

• is OK

D:\adp1.adp

• is OK

D:\b\sp2\update\update.exe

• is OK

D:\b8d3cf5cb0ed479f9c65779eb834e325\sp2 [E] Access is denied (5)

The last line looks ominous (I haven't a clue what that file is!!!) although Avast S.I. doesn’t show that it has moved onto scanning the D: drive (partition), any help?. Btw: 160gig HD with two NFTS partitions.

Thanks again for any info.

[Vlk]

Thanks for the informative post!

How large is the D:\b8d3cf5cb0ed479f9c65779eb834e325 folder?
What does it contain? Are the any subdirs?
Looks like a post-mortem piece of SP2 installation to me.

Also, try scanning this folder. Does it work?

Appearently, the scan has moved to disk D:\ but the user interface has not yet registered it. Well, the UI is asynchronous meaning that it only updates the info in a low-priority background thread (to prevent excessive CPU usage) so that's probably nothing to worry about... (given that the scanner has just started scanning D:\...).

Lookin' forward to your reply,
Vlk

[Walker]

Thanks Vlk for the continued interest.

Now this is strange. I haven't played about with file/folder attributes for many a year. But I can't figure how to get into this ....\sp2 folder. It comes up in Windows properties as 'Read only', but I 'de-check this and I am still denied access (that is the Windows message "Access denied")

I tried Avast on that folder with a couple of other folders that look as if they have been created by the same application (as you say Windows update looks a good bet).

On two attempts Avast reports 2/8 folders and 384kb scanned and seems to complete with a 'beep'. On two other attempts it seems to hang and do nothing. CPU usage running (whilst hung) at 25-40% PF usage at 10mb seemingly for Avast (PF drops 10 mb once I get Avast shut down from Task manager).

Looks as though we have identified at least part of the problem. I am obviously failing in that I don't know how to get access to that directory or even what those folders are or why they are there!

Here is the latest repost:-

*
* avast! Report
* This file is generated automatically
*
* Task 'Simple user interface' used
* Started on Wednesday, September 03, 2003 8:25:09 PM
*

D:\71b78a12c0e8dd9903aa\sp2\update\update.exe

• is OK

D:\849111747cfcd62f212\sp2\update\update.exe

• is OK

D:\adp1.adp

• is OK

D:\b\sp2\update\update.exe

• is OK

D:\b8d3cf5cb0ed479f9c65779eb834e325\sp2 [E] Access is denied (5)

Sorry to go on, any more thoughts?

Thanks yet again.

[Vlk]

Indeed an interesting problem...

I'm starting to think that there must be some kind of file-system problem in the directory (like a cross-linked directory-entry or something...). The only thing that spoils this idea is that the scan completes normally unless its level is set to Thorough...

Could you try chkdsk'ing the volume?

Couple of more things -- since the error code is Access Denied (and the directory is located on a NTFS volume, isn't it?) there may be some very exotic rights assigned to it. So I advise to check the ACLs and/or maybe try to grant (at least read-) access to the Everyone group.

Finally, the directory may be encrypted with some uknown/foreign/deleted key. To find out whether it's encrypted, you can use the Attributes --> Advanced button in the File Properties in Explorer.


Now I'm really curious!

Thanks for your patience,
Vlk

[Walker]

Hi Vlk,

I’ll persevere with this as you seem interested. I’m hoping it isn’t a waste of your time.

Anyway, I ran CHKDSK on that volume and it reported:-

“CHKDSK discovered free space marked as allocated in the volume bitmap.
Windows found problems with the file system”

OK, so I ran CHKDSK again with the \f  switch and everything was reported as ‘fixed’.

Ran Avast on the Standard scan, everything seemed fine. Here is the top and bottom of the report, leaving out the middle for brevity.:-

Top part of report:-

*
* avast! Report
* This file is generated automatically
*
* Task 'Simple user interface' used
* Started on Wednesday, September 03, 2003 11:29:28 PM
*

D:\71b78a12c0e8dd9903aa\sp2\update\update.exe

• is OK

D:\849111747cfcd62f212\sp2\update\update.exe

• is OK

D:\adp1.adp

• is OK

D:\b\sp2\update\update.exe

• is OK

D:\b8d3cf5cb0ed479f9c65779eb834e325\sp2 [E] Access is denied (5)
D:\Backup\Backup.bkf

• is OK

D:\Backup\C Drive\Full\Backup.bkf

• is OK

D:\Backup\C Drive\Part\Backup.bkf

• is OK

D:\Backup\Current\31 8 03\Backup.bkf

• is OK

D:\Backup\Current\Fresh XP Pro\Backup.bkf

• is OK

D:\Backup\Current\XP Pro with e-mail\Backup.bkf

• is OK

D:\conceptronic\wdm373cu\w2kxp\ASUC2032.DLL

• is OK

Bottom part of same report:-

D:\Website\Templates\vbs_script_html.tpl

• is OK

D:\Website\Templates\vis_basic.tpl

• is OK

D:\Website\Thumbs.db

• is OK

Infected files: 0
Total files: 2462
Total folders: 130
Total size: 35.6 G

*
* Task stopped: Wednesday, September 03, 2003 11:29:48 PM
* Run-time was 20 second(s)
*

I then switched to Thorough scan and it hung again. One other strange thing I found, I had to select the individual (D: drive) twice. Selecting just this drive to scan on the first attempts Avast goes off and starts scanning all drives.

Here is the complete report from the Thorough scan:-


* avast! Report
* This file is generated automatically
*
* Task 'Simple user interface' used
* Started on Wednesday, September 03, 2003 11:33:07 PM
*

D:\71b78a12c0e8dd9903aa\sp2\update\update.exe

• is OK

D:\849111747cfcd62f212\sp2\update\update.exe

• is OK

D:\adp1.adp

• is OK

D:\b\sp2\update\update.exe

• is OK

D:\b8d3cf5cb0ed479f9c65779eb834e325\sp2 [E] Access is denied (5)

Next thing, I checked the suspect directories properties again in Windows. I’m still getting ‘Access denied’ so de-clicked the read only attrib again, still denied, look again at the properties and read only has been reset. Happens the same each time (yes, I am clicking ‘Apply after making changes)<g>. Advanced shows no Encryption set.

Sorry, I’m sure it will be obvious when you  tell me, but I can’t think what you meant by ACL’s.

For info., I can’t get access to that directory under DOS (Command prompt).. Sorry for the length, (tell me if I should post this amount of data) but here is a portion of the DOS prompt dir dump:-


 Directory of D:\

21/08/2003  01:30    <DIR>          71b78a12c0e8dd9903aa
21/08/2003  01:56    <DIR>          849111747cfcd62f212
10/08/2003  04:14            15,872 adp1.adp
21/08/2003  01:31    <DIR>          b
20/08/2003  00:48    <DIR>          b8d3cf5cb0ed479f9c65779eb834e325
19/08/2003  20:34    <DIR>          Backup
19/08/2003  17:18    <DIR>          conceptronic
31/07/2003  20:52    <DIR>          Data
10/08/2003  04:18           163,840 db1.mdb
10/08/2003  10:57        15,548,416 FrmSmp00.mdb
17/08/2003  20:32    <DIR>          FTP

 Directory of D:\71b78a12c0e8dd9903aa

21/08/2003  01:30    <DIR>          .
21/08/2003  01:30    <DIR>          ..
21/08/2003  01:30    <DIR>          sp2
               0 File(s)              0 bytes

 Directory of D:\71b78a12c0e8dd9903aa\sp2

21/08/2003  01:30    <DIR>          .
21/08/2003  01:30    <DIR>          ..
21/08/2003  01:30    <DIR>          update
               0 File(s)              0 bytes

 Directory of D:\71b78a12c0e8dd9903aa\sp2\update

21/08/2003  01:30    <DIR>          .
21/08/2003  01:30    <DIR>          ..
21/09/2002  12:44           273,408 update.exe
               1 File(s)        273,408 bytes

 Directory of D:\849111747cfcd62f212

21/08/2003  01:56    <DIR>          .
21/08/2003  01:56    <DIR>          ..
21/08/2003  01:56    <DIR>          sp2
               0 File(s)              0 bytes

 Directory of D:\849111747cfcd62f212\sp2

21/08/2003  01:56    <DIR>          .
21/08/2003  01:56    <DIR>          ..
21/08/2003  01:56    <DIR>          update
               0 File(s)              0 bytes

 Directory of D:\849111747cfcd62f212\sp2\update

21/08/2003  01:56    <DIR>          .
21/08/2003  01:56    <DIR>          ..
21/09/2002  12:44           273,408 update.exe
               1 File(s)        273,408 bytes

 Directory of D:\b

21/08/2003  01:31    <DIR>          .
21/08/2003  01:31    <DIR>          ..
21/08/2003  01:31    <DIR>          sp2
               0 File(s)              0 bytes

 Directory of D:\b\sp2

21/08/2003  01:31    <DIR>          .
21/08/2003  01:31    <DIR>          ..
21/08/2003  01:31    <DIR>          update
               0 File(s)              0 bytes

 Directory of D:\b\sp2\update

21/08/2003  01:31    <DIR>          .
21/08/2003  01:31    <DIR>          ..
21/09/2002  12:44           273,408 update.exe
               1 File(s)        273,408 bytes

 Directory of D:\b8d3cf5cb0ed479f9c65779eb834e325

20/08/2003  00:48    <DIR>          .
20/08/2003  00:48    <DIR>          ..
20/08/2003  00:48    <DIR>          sp2
               0 File(s)              0 bytes

**Chopped out middle**

Directory of D:\WUTemp

31/08/2003  12:40    <DIR>          .
31/08/2003  12:40    <DIR>          ..
               0 File(s)              0 bytes

     Total Files Listed:
            2452 File(s) 38,244,815,303 bytes
             367 Dir(s)  81,399,705,600 bytes free



I’m bemused and stumped.

[Vlk]

Thanks for yout time.

First question: what is the size of the file D:\Backup\Backup.bkf ? Is it big (like real big)? Given the reports I'd say this is the file that is causing the problems - not the damn SP2 directory... But we'll see.

Next thing, I checked the suspect directories properties again in Windows. I’m still getting ‘Access denied’ so de-clicked the read only attrib again, still denied, look again at the properties and read only has been reset. Happens the same each time (yes, I am clicking ‘Apply after making changes)<g>. Advanced shows no Encryption set.

This is really strange... but anyway, I think this is how it behaves if you don't have the rights to do the change, ie. the ACL is not good for you
(see below). I just confirmed that Explorer is dumb enough to not report any respective erros when changing file attributes...

Sorry, I’m sure it will be obvious when you  tell me, but I can’t think what you meant by ACL’s.

The ACL, an acronym for Access Control List, is a list of users/group and their respective rights. As you probably know, the NTFS file system supports ACLs assigned to individual files and directories. Using this mechanism, it is possible to assign access rights to files/dirs.

My guess is that the ACL for the SP2 directory has been somewhat played with, resulting in the fact that even you (presumable a member of the local Admin group) can't open it. To verify this, go to the folder properties and check out the Security tab. Note that the NT ACLs are designed in such a way that you might not be able to open the object but still, you may have the rights to assign extra rights to the object that will let you open it (or "take the ownership" of it which is basically equivalent to getting full access to it).

Anyway, as I already said, I don't believe the inaccessibility of the SP2 folder is by any means related to the avast issue but for the sake of clarity I'd like to sort this problem out as well....

Thanks again,
Vlk

[Walker]

Hi again Vlk,

Your powers of perception and deduction serve you very well.

I hadn’t considered those backup files following the sp2 we had been looking at!. And you are correct, 5.8gb in size.

You have my apologies for not spotting this. The fact that the U.I. had stuck on the C: drive/Windows directory and then the report pointing towards the access denied directory all added up to be quiet a coincidence with the backup files following in the next part of the scan. Well done for seeing it.

Anyway, I (Thorough) scanned again, full scan, both partitions and it hung at the same place again (CPU usage steady between 0-5%). I then Thorough scanned the sp2 directory on it’s own and then that backup directory on it’s own. Both scans completed OK. I then went back and Thorough scanned the entire computer again and this time it scanned OK (CPU usage constantly high, around 20-40%). It did however take nearly 1 hour to complete, to be expected with those large backup files. I have no idea why it didn’t complete prior to me scanning the individual directories!. But it is now working fine. Thank you for your patience.

If you don’t mind, can I ask you more about the ACL you mentioned? I highlight the folder that I don’t have access to (or any other folder), click properties, but do not have the ‘Security’ tab you refer to. I have General, Sharing and Customize and can’t seem to find a Security option anywhere in the ‘sub’ menus!. I think I know what these long numbered folders are and again you already had it… it is to do with the MS Windows update function. I think the one that is ‘Denied’ fits in with the date that MS’s update/auto install program was updated. However, I do get fed up with Bill Gates putting folders on my computer, so I’d like to try to delete them *if* I can get access. Btw: this is a ‘personal’ pc and I do/should have full access rights.

Thanks for the help, support has proved to be exceptional, even on the ‘free’ option. When my wife comes home with my credit card :'(, I will be purchasing.

[Vlk]

Hi, I'm glad we're approaching the final denouement. This is definitely one of the most entertaining issues I've seen recently... And believe me - I like this stuff.

What I don't like is the inconsistency of results. I hate when computer stuff behaves "randomly", and this seems to be the case. There must be some pesky bug that only pops up once a time and then keeps pretending it's not there...

Total scanning time of 1 hour seems quite reasonable to me - a thorough scan really means every single bit of your data gets processed, and that may, of course, take some time.

There are two facts that we can use for further analysis:
1. it happens only if the scan level is set to Thorough.
2. when it happens, the CPU usage drops to zero.

Especially point 2. is important because it means that the scanner is not doing anything, in other words, it is waiting for something. The thing it is waiting for can, but may not occur. If it does not, we call it a deadlock (ie. it stays infinitely locked up). So the elementary question here is 'what the hack is it waiting for?' Unfortunately, to find out this, I'd need to have a debugger to your machine. Or (if you'd be willing) you could do a simple debugging session for me, and send me the results. It wouldn't take you more than a couple of minutes and the result would be a dump file of size approx. 40MB that I'd then have to download from somewhere (I don't know if you have any means of sending it to me or exposing it on a web page/ftp site) and scrutinize. So... if you'd be willing to go for it I'd be real thankful.

One more question: is any of the backup files larger than 4GB? Or 2GB?

About the ACLs... from what you're writing it seems to me that your disk is formatted as FAT32, not NTFS. Am I wrong? Because otherwise, there really should be the Security tab (on my machine, it's between Sharing and Customize).

Anyway, I absolutely agree that such a behavior of Windows Update is totally unacceptable. Not only that it creates a number of folders with rubbish names in the root directory of your disk (!) but it makes them inaccessible/undeletable?!?! I just can't believe it (although I gotta admit I've got a bunch of there folders on my root as well - but at least I can remove them).

When my wife comes home with my credit card , I will be purchasing.

Hehe, greetings to your wife ("the Treasurer"). And - good luck!

Thanks,
Vlk

[Walker]

Hi Vlk,

I admire your persistence and agree it is annoying when you can’t say it is/was definitely this or that.

Both of your points are correct 1 and 2, and I understand 'why' perfectly. What I originally noticed was that the hang would happen and CPU usage would be very low or zero. Using Task manager to get out of it would send CPU usage sky high for a considerable amount of time. It seemed to struggle to shut down Avast, almost as though shutting down from Task manager had kicked it back into action, but by that time Task manager was shutting it down so I’ll never be able to prove that.

And yes the figure of 5.8Gig that I mentioned was for just one of the backup files.

I can understand your questioning, I can assure you that both partitions on the drive are definitely, absolutely, 100% NTFS, but I can’t find a Security Tab on ANY folder C: or D: drive/partition!!!. Do you think there is a separate option somewhere else in Windows setup that enables/disables this Tab?.

Of course, no problem, I’ll run whatever debugging you wish… just give me the low-down on what to do.

Thanks for putting my blood pressure up , neither my wife nor my credit card have been seen all day and Spanish shopping goes on until 10pm

[Vlk]

Thanks again for your post.

And yes the figure of 5.8Gig that I mentioned was for just one of the backup files.

OK, this itself proves that is IS a NTFS partition. FAT32 can IMHO handle only files < 4G (but I may be wrong on this). Anyway, such a huge file can indeed cause some problems, because most internal counters are 32-bit and therefore have a 4G limit. avast! tries to use 64-bit file size values wherever possible but it's possible that there is a bug in this code as it is usually very little "stressed" (really not much files are that big - even DVD's can't handle such giant files - they have to be stripped into fragments...).

I can understand your questioning, I can assure you that both partitions on the drive are definitely, absolutely, 100%  NTFS, but I can’t find a Security Tab on ANY folder C: or D: drive/partition!!!. Do you think there is a separate option somewhere else in Windows setup that enables/disables this Tab?.

I did a simple google query and voila - here comes the answer:
http://groups.google.com/groups?hl=en&lr=&ie=UTF-8&oe=UTF-8&threadm=Nv%25X8.346625%24R61.323527%40rwcrnsc52.ops.asp.att.net&rnum=1&prev=/groups%3Fq%3Dproperties%2Bsecurity%2Btab%2Bmissing%26ie%3DUTF-8%26oe%3DUTF-8%26hl%3Den

I believe it's gonna work...

Of course, no problem, I’ll run whatever debugging you wish… just give me the low-down on what to do.

Excellent, here we go. Download the debugger here:
http://msdl.microsoft.com/download/symbols/debuggers/dbg_x86_6.2.13.1.exe

(it's a MS thing so, in theory, it shouldn't hurt your system, right? --no really, i'm kidding, it works pretty well). Install it with default settings.

Then simulate the problem - i.e. start a thorough scan in avast and wait for it to freeze (with zero CPU usage, meaning it's really stuck). Then it's time to start the debugger. When started, hit F6 and in the process list, select "ashSimpl.exe" (the avast Simple User Interface process). This will attach the debugger to the avast process.

Next, go to the Command window, it has a command prompt line at the bottom. From there, type the following

.symfix

this will instruct the debugger to use the Microsoft debugging symbol server. This command should be accepted by the debugger with a message similar to this:

No downstream store given, using blablabla
Symbol search path is: SRV**http://msdl.microsoft.com/download/symbols

Now we're almost done. All we have to do is tell the debugger to dump the process to a file. For this, we use the .dump command in the following form

.dump /ma c:\avast.dmp

This command can take some time to complete (depending on the speed of your Internet connection, because it will be donwloading the symbols from the MS site). I think a minute or two would sound reasonable. The tricky part is that it's hard to tell if the command has already been completed - the debugger just won't tell you. The best way to find out is to type some garbage to the command prompt and see whether it's responding or not. If it's responding (i.e. coplaining about invalid command or something like that), the previous command has already completed and we're ready to go.

After that you can shut everything down - both the debugger and avast. The last part consists in ZIPing the c:\avast.dmp file and delivering it to me -- it would be ideal if you could put it to some HTTP/FTP site so that I could download it... do you think it would be possible?

I hope there won't be any problems, and that you don't hate me

Thanks,
Vlk

[Walker]

Hi Vlk,

It’s no problem, but I’ve spent ALL night trying to replicate the lock up.

D/l´d the debugger OK, then I tried the link to your google search for the security tab answer... wouldn’t find the page. No prob again, I did the same search and found an answers… great.

Then in my excitement and without thinking, I got access to all of those ***\sp2 directories and deleted the lot.

Then went on to try and get the debug info… guess what Avast wouldn’t ‘hang’… went through all of those 5.8GB files without a hitch (four times at 40mins a pop!).

OK, well as I mentioned previously, my last attempts also worked (after I had scanned the files ‘individually’ and then reverted to the entire hard drive), so I didn’t know if I’d inadvertently fixed the problem previously!.

Not to be deterred, I dug those ***\sp2 folders files out of the recycle bin and re-instated them. Started running the scan in all sorts of modes (Standard/Thorough, with Archive, without Archive, partial, full etc etc… all combinations). No way can I now get it to hang.

No Vlk, I don’t hate you, you persevered with this problem and I wanted to get the debug info., but sorry, I’ve failed.

What I am going to do is, keep the dbg_x86_6.2.13.1.exe file handy and load if and as soon as I get the problem again… is that OK?.

Of course, in the meantime, I going for the full version on the strength of all your help and support… as long as there’s some credit left on my card   :'( after te missuses shopping trip.

Thanks for all of your brilliant help.

[Vlk]

My friend, thanks for all your help. It was indeed an enchanting time spent on this topic...

I also feel sorry that we didn't reach the final solution but - c'est la vie, right? Maybe next time...

I'd be grateful if you could keep the debugger handy - although it's just a 8MB download so really not a big deal if you delete it...

Of course, in the meantime, I going for the full version on the strength of all your help and support… as long as there’s some credit left on my card   after te missuses shopping trip.

Please don't feel obliged in any way - we don't want you to go bankrupt because of us!

Anyway, thanks for all your help, and congratulations for your excellent computer skills (are you a computer professional?)

Vlk

[Walker]

Hi Vlk,

Unfortunately, a professional I am not and any computer skills I may have once had, have been lost in the passing of time . My interest used to be SCO UNIX, then 65 million years ago that meteorite struck and I took my rightfull place alonside dino and betamax vcr's

I will keep the debugger handy for this (don't tell fibs , it's not 8Mb, it's 8.6Mb... you see I did d/l it and was trying )

From some of your comments, it is perhaps good that we have at least established that Avast does (in my circumstances anyway) handle files over 4Gb. Little consulation for not finding the original problem I know.

It's not 'obligation' in that sense (referring to buying the Pro version). I much prefer to support programs like Avast than I do 'most' of the others (I've never liked NAV since it went flakey under Windows a few years back. Not that I'm saying Windows or MS are wonderful), it's outta respect for you guys and the ethos and people behind such programs, your support added to that. Oh and it didn't hurt you saying I had computer skills <very big smile>

Anyway, when Emelda Marcus came home last night with another 3 pairs of shoes charged against my credit card , I asked if I could borrow my card   and registered Avast.

Well done guys, thanks for the software (hope there's nothing new for this ageing old dog to have to learn in the Pro version) and thank you Vlk for the very efficient and much appreciated support.

Ken C